Main menu

Tracking The Impact of the WhatsApp Blockage on Tor

On May 2, 2016, a Brazilian judge ordered cell phone carriers to block access to the messaging service WhatsApp for 72 hours. The order applied to the whole nation of Brazil—100 million WhatsApp users. Worldwide, Internet censorship events happen frequently. They may occur in countries like Brazil or in oppressive regimes like Egypt or Saudi Arabia. We want to understand better what happens during these events.

If we can watch certain data points, we can observe, for instance, whether or not our tools are efficiently circumventing such blockages. The Tor Project has a set of tools that can help us learn these answers. We can not only identify whether a censorship event has happened, but see how it was accomplished by the censor, and observe if people are using our tool to bypass it.

The Open Observatory of Network Interference (OONI) is a Tor project focused on detecting censorship, surveillance, and traffic manipulation on the Internet. For the recent WhatsApp case, OONI published a report showing that the Brazilian mobile carriers blocked WhatsApp’s website through DNS hijacking.

While OONI tests are not currently designed to directly test instant messaging (IM) protocols, OONI did monitor access to the WhatsApp website. This data allows us to analyze the censorship mechanisms used, and to determine if tools like Tor can bypass the block.

In this case, an Android user could download Orbot, a Tor proxy tool for Android, and successfully bypass the censorship with its VPN mode.

As soon as the blockade was announced, we began promoting key tips in Portuguese on social media and elsewhere to instruct Brazilians about how to bypass the WhatsApp blockage on Android with Orbot.

For Orbot statistics, we don't use Google Analytics or other system to track Orbot users, other than what Google Play can show us about installs and uninstalls. Based only on that, Orbot's active install for Brazil on May 1st was at 33,458. On May 2nd it went up to 41,333.

Taking a look at the number of downloads for Orbot in Brazil, we saw a 20% to 30% increase in the rate of downloading on those days.

There was a similar increase on the Tor network, where the average number of daily direct connected users for Brazil, went from ~50,000 to 60,000 in 24 hours.

Our metrics.torproject.org portal, which hosts data visualizations from our network, also caught the circumvention event. The little blue dot represents the fact that something is happening in the region. Is great to see that even for very sudden and short-lived actions (the block was lifted in Brazil after about 24 hours), we were still capable of capturing it in our data. You can read here about how we do it and the precautions we take while collecting such data so we don't affect user privacy.

We know that we are talking about a small number of users in a world of 100 million, in the case of WhatsApp. There is still a lot of work to be done to help people become aware of such tools. However, it is great to see our projects coming together to tell this story.

Our experience with the WhatsApp blockage in Brazil demonstrates the potential these efforts have to provide us with information about censorship events and to help us build circumvention mechanisms against them.

We are working hard on new features for these tools; for instance, we want to deploy more mobile network tests for OONI and better visualizations of our data so that others can easily explore and learn from them, and we continue to improve user experience on our apps. Keep an eye on this blog as we develop this work!

Protecting the ability of ordinary people to communicate and the ability of journalists to report freely on political and epidemiological dangers which affect (at least indirectly) the entire Western Hemisphere is one of the most important things any human/civil rights type organization can do. The amazing thing is that this is just one of the essential things which require Tor. Or a small number of other highly endangered technical means, including WhatsApp, which enable us to read uncensored news and communicate what is really happening in Brazil, China, USA, France, East Africa, &c.

Thanks to everyone at Tor Project for all your hard work--- Tor is making an enormous positive difference in the world at a time when almost everything else seems to be falling apart!

Thank you for this post. Even though I already knew about the Tor Project, it was only with the blockage that Orbot got in my radar. I've been using it ever since and also discovered Orfox, but it's still in beta.

There is something wrong with the images, I cannot see them here or with the Internet Archive.

Hi! There's a new alpha release available for download. If you build Tor from source, you can download the source code for 0.3.3.2-alpha from the usual place on the website. Packages should be available over the coming weeks, with a new alpha Tor Browser release some time in February.

Remember, this is an alpha release: you should only run this if you'd like to find and report more bugs than usual.

Tor 0.3.3.2-alpha is the second alpha in the 0.3.3.x series. It introduces a mechanism to handle the high loads that many relay operators have been reporting recently. It also fixes several bugs in older releases. If this new code proves reliable, we plan to backport it to older supported release series.

Changes in version 0.3.3.2-alpha - 2018-02-10

Major features (denial-of-service mitigation):

Give relays some defenses against the recent network overload. We start with three defenses (default parameters in parentheses). First: if a single client address makes too many concurrent connections (>100), hang up on further connections. Second: if a single client address makes circuits too quickly (more than 3 per second, with an allowed burst of 90) while also having too many connections open (3), refuse new create cells for the next while (1-2 hours). Third: if a client asks to establish a rendezvous point to you directly, ignore the request. These defenses can be manually controlled by new torrc options, but relays will also take guidance from consensus parameters, so there's no need to configure anything manually. Implements ticket 24902.

Major bugfixes (netflow padding):

Stop adding unneeded channel padding right after we finish flushing to a connection that has been trying to flush for many seconds. Instead, treat all partial or complete flushes as activity on the channel, which will defer the time until we need to add padding. This fix should resolve confusing and scary log messages like "Channel padding timeout scheduled 221453ms in the past." Fixes bug 22212; bugfix on 0.3.1.1-alpha.